Bitcoinmagazine Liquid Network Hack: $320 Million in Bitcoin Withdrawn by Purported White-Hat Hackers
Article Content
- •Approximately 4,000 BTC worth $320 million were withdrawn from Liquid Network's wallet.
- •The hackers exploited a vulnerability in the Elements software, not through compromised keys.
- •Liquid Network has paused all transactions and is in communication with the hackers regarding fund return.
On September 6, 2026, approximately 4,000 BTC, valued at around $320 million, were withdrawn from the Liquid Network's federation wallet by unidentified actors claiming to be white-hat hackers. The withdrawal represented about 95% of the network's total reserves, which were approximately 4,200 BTC prior to the incident. The hackers exploited a vulnerability in the Elements software, allowing them to create L-BTC that was not backed by actual Bitcoin. Liquid Network has since paused transactions and disabled bridge nodes while investigating the incident. Communication between the hackers and Blockstream, the network's provider, has occurred via on-chain messages, with the hackers stating they would return 'most' of the stolen funds if the vulnerability is fixed. The situation raises significant concerns regarding the security of crypto infrastructure. As of now, the funds remain under the hackers' control, and there is no guarantee of their return.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (26)
Following this threat?
Track Blockstream in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…